2. 1 Figure 6-5: Turning Off Unnecessary Services Unnecessary Services  Operating system vendors used to install many services by default  This made them easier to use. When use changes, services do not have to be turned on.  Attackers have found flaws in many of these rare services

3. 2 Figure 6-5: Turning Off Unnecessary Services Unnecessary Services  Vendors now install fewer services by default—lock down mode  Turn to security baseline to see what services to turn on and off  Easier to install too few and add than to install too many and remove unwanted services

4. 3 Figure 6-5: Turning Off Unnecessary Services Turning Off Services In Windows  Go to the Computer Management MMC  On the tree, select Services and Applications (Figure 6-6) Status tells whether the service is active Startup tells how the service is started (automatic, manual, disabled, etc.)  Right click on a service or select and choose Action to stop a service, start it, disable it, etc.

5. 4 Figure 6-6: Services and Applications in Windows

6. 5 Figure 6-5: Turning Off Unnecessary Services Turning Off Services In UNIX  Three ways to start services inetd to start services when requests come in from users (Figure 6-7) rc scripts to start services automatically at book up (Figure 6-8) Start a service manually by typing its name or executing a batch file that does so

7. 6 Figure 6-7: UNIX inetd Daemon for Responding to Client Requests Program A Program B Program C Program D inetd Port 23 Program A Port 80 Program B Port 123 Program C Port 1510 Program D 1. Client Request To Port 80 4. Start and Process This Request 3. Program B 2. Port 80 inetd.config

8. 7 Figure 6-8 The UNIX rc.d Method of Automatically Starting Services /etc/rc.d 1. Script for Service A 2. Script for Service B 3. Script for Service F 4. Script for Service H rc0.d [scripts to run during System Mode 0-shutdown] K2... [Run the Kill portion of Script 2: Kills Service B] K3... [Run the Kill portion of Script 3: Kills Service F]... rc.d directory Scripts for services. Contain scripts to start or kill services. Directory rc0.d. Subdirectory of rc.d. Contains scripts to run start or kill portions of scripts in rc.d directory. These scripts are executed if run mode 0 occurs—system shutdown

9. 8 Figure 6-8 The UNIX rc.d Method of Automatically Starting Services rc1.d rc2.d rc3.d rc4.d rc5.d rc6.d [scripts to run during System Mode 6-startup] S1... [Run the Start portion of Script 1: Starts Service A] S2... [Run the Start portion of Script 2: Starts Service B]... rcs.d [scripts to run during System Mode s—single-user mode] Other subdirectories of rc.d for scripts to execute in different run modes, such as run mode 6—startup

10. 9 Figure 6-5: Turning Off Unnecessary Services Turning Off Services In UNIX  Identifying services that are running at any moment ps (processor status), usually with –aux parameters, lists running programs  Shows process name and process ID (PID) netstat tells what services are running on what ports

11. 10 Figure 6-5: Turning Off Unnecessary Services Turning Off Services In UNIX  kill PID to kill a particular process  kill 47 (If PID=47) Add parameters –SIGTERM, -SIGHUP, -SIGKILL in order of increasing urgency  kill 47 –SIGTERM (PID = 47) Only kills for now. Must search inetd.config, rc scripts, batch files to see where it is being started automatically. Difficult to do.